Weave Code
Laravel Saml2 Laravel Package
24slides/laravel-saml2
Integrate SAML2 single sign-on into Laravel applications. This package wraps the OneLogin SAML PHP Toolkit, providing service provider routes, IdP configuration, metadata endpoints, login/logout handling, and customizable user resolution for enterprise SSO.
An integration to add SSO to your service via SAML2 protocol based on OneLogin toolkit with support of multiple Identity Providers
Frequently asked questions about Laravel Saml2
- How do I install 24slides/laravel-saml2 in a Laravel application?
- Install it with Composer using composer require 24slides/laravel-saml2. Laravel package auto-discovery registers the service provider, so no manual provider entry is needed. Publish the package config with php artisan vendor:publish and set your service provider entity ID, ACS URL, and IdP certificate and SSO endpoint values. Then give your IdP the package metadata URL so it can register your application as a service provider.
- Which Laravel versions does this SAML2 package support?
- Release 2.7.2 adds Laravel 13 support and refreshes the dependency constraint set, but the notes do not spell out the full supported range. Before pinning it on a long-lived platform, read the require block in composer.json to confirm your current production Laravel version is still inside the constraint. The release is described as a compatibility and maintenance patch with no API or config schema changes, so upgrading within the supported window should be low ceremony.
- Can one Laravel app use multiple Identity Providers with this package?
- Yes. The package is built on the OneLogin SAML toolkit and adds support for multiple IdP profiles, so a single Laravel application can act as a service provider for more than one enterprise IdP. Each IdP has its own entity ID, SSO endpoint, and signing certificate configured in the package config, and the login flow selects the correct profile. This is useful for subsidiaries, partner tenants, or staged migrations between identity providers, though it is not the same as a full multi-tenant federation broker.
- How do I configure IdP metadata and certificates for laravel-saml2?
- Configuration lives in the published saml2 config file, where you define your service provider entity ID, assertion consumer service URL, and the IdP entity ID, single sign-on URL, and X.509 certificate. Paste the IdP metadata values exactly as provided, because a mismatched entity ID or audience will break login. Expose your own SP metadata endpoint to the IdP so both sides agree on endpoints and certificates. Validate the full round trip in a staging IdP tenant before touching production.
- What SAML routes and endpoints does the package register?
- The package conventionally exposes service provider routes for login, the assertion consumer service, metadata, logout, and single logout. Your IdP needs the metadata URL to import your SP configuration, and it posts SAML responses back to the ACS route. Because these routes and middleware are registered as normal Laravel routes, they inherit your route groups, HTTPS enforcement, and middleware stack. Check the package route list after install so you can place them behind the right domain or prefix.
- How do I map a SAML identity to a Laravel user after login?
- The package handles the SAML protocol and hands you the authenticated identity, including the NameID and assertion attributes. You provide the user resolution logic that looks up or creates an Eloquent user, optionally syncs attributes such as email or groups, and then logs them into Laravel with the standard Auth facade. Keeping this mapping explicit is important because attribute names differ between Okta, Entra ID, OneLogin, and ADFS. Test the mapping against real assertions from each IdP rather than assuming a common schema.
- Does this package support single logout and IdP-initiated login?
- The package provides service provider logout and single logout endpoints, so SP-initiated SLO can be wired to your IdP session termination flow. IdP-initiated responses can be accepted at the assertion consumer service, and encrypted assertions or signed response requirements are configured through the underlying OneLogin toolkit settings. Whether all three behaviors work cleanly depends on your IdP contract, so confirm SLO, encrypted assertions, and IdP-initiated flows during integration testing. Treat any gap as a contract requirement, not an implementation detail.
- What are the production security risks of SAML2 in Laravel?
- SAML is security-critical, and relaxed settings cause real authentication bypasses rather than graceful degradation. Keep signature validation strict, verify the audience and recipient, enforce HTTPS on ACS and metadata endpoints, and allow only a small clock skew. A misconfigured certificate or entity ID usually produces a total login outage for the affected tenant, so roll out changes to a pilot IdP first. Also review upstream dependency advisories for the XML, crypto, and HTTP libraries the toolkit pulls in, since those sit outside this package's version number.
- How can I test SAML login locally or in CI?
- Use a test identity provider such as a SAMLtest instance or a staging Okta, Entra ID, or OneLogin tenant that points at your local or CI ACS URL. Override the package config in your test environment and write feature tests around the login, ACS, and user resolution paths. Never disable signature validation to make tests pass, because that habit tends to reach production. A parallel-path rollout, with the new SP running alongside the old one on a distinct route, is the safest way to validate before cutover.
- What alternatives exist to 24slides/laravel-saml2, and when should I avoid it?
- If your IdP supports OIDC, Laravel Socialite or an OIDC client may be simpler than SAML. For SAML specifically, teams also use aacotroneo/laravel-saml2 or integrate the OneLogin php-saml toolkit directly. Avoid this package if you need a full multi-tenant identity broker, non-SAML protocols, or an identity provider rather than a service provider. It is a single-maintainer-led community project, so weigh bus factor and security-response cadence when putting it on a multi-year roadmap.
Weaver
How can I help you explore Laravel packages today?